QR Office Privacy Policy
Effective date: 30 October 2026 · Last updated: 30 October 2026
This privacy policy explains what information the QR Office app and the website https://qroffice.bugbittle.com collect, why, and the choices you have. It applies only to QR Office. Where this policy and the general BugBittle privacy policy differ, this policy applies to QR Office.
1. Who we are
QR Office is made by BUGBITTLE (PRIVATE) LIMITED ("BugBittle", "we", "us"), Johar Town, Lahore, Pakistan.
- Privacy questions and requests: privacy@bugbittle.com
- App support: support@bugbittle.com
2. The short version
- You don't need an account. We never ask for your name.
- The QR codes you create and scan stay on your phone. We never see them.
- Creating and scanning work offline.
- Wi-Fi passwords and 2FA secrets are encrypted on your phone.
- Links never open without your confirmation.
- The free version shows ads from Google AdMob. Premium removes them. On iOS we request only non-personalised ads and we don't track you.
- A small amount of technical information leaves your phone so the app can work, show ads, process purchases, fix crashes and improve. Section 4 lists all of it.
- We don't sell your personal information.
3. Information that stays on your phone
The following is stored only on your device and is never sent to us:
- Codes you create and their names, designs and export settings.
- Codes you scan and their content, including links, contacts, Wi-Fi details, calendar events, locations, 2FA setup codes and passkey codes.
- Your History, favourites, folders and settings.
- Logos you add to codes (Premium). They are copied into the app's storage on your phone.
Wi-Fi passwords and 2FA secrets are stored encrypted using your phone's secure storage and are shown only after you unlock with Face ID, fingerprint or passcode.
On Android, backups of the app's data are turned off. On iOS, your phone's own iCloud or computer backup may include the app's data; Apple handles those backups under its own privacy terms.
4. Information that leaves your phone
| What | Details | Why | Who processes it |
|---|---|---|---|
| Device record | A device identifier created by the app, phone model, operating system and app version, country taken from your region setting, and language | To run the app, link support requests and purchases to a device, and keep the service secure | Google Firebase (on our behalf) |
| Support and feedback messages | The email address you type, your message, and the device record | To answer you and improve the app | Google Firebase (on our behalf) |
| Usage statistics | Which features are used and how often, for example "a code was created" or "a scan was completed". Never the content of any code | To understand which features matter and improve the app | Google Firebase Analytics |
| Crash reports | Technical details about a crash, the device record and app state at the time. Never the content of your codes | To find and fix bugs | Google Firebase Crashlytics |
| Ad data | Advertising identifier (where allowed), IP address, device and app information, and how you interact with ads | To show ads, measure them and prevent ad fraud | Google AdMob |
| Purchase status | An anonymous purchase ID, the Premium plan you bought, its status and store receipts | To unlock Premium and let you restore it | RevenueCat, Apple and Google |
We never receive your payment card or bank details. Payments are handled entirely by Apple or Google.
5. Permissions the app asks for
| Permission | When it is asked | What it is used for |
|---|---|---|
| Camera | Only when you start scanning | Reading QR codes. Nothing is recorded or uploaded |
| Photos | Through the system picker, only when you choose a photo | Reading a QR code from an image, picking a logo for a code, or saving a code you created |
| Contacts | Only when you choose to pick a contact for a Contact code | Filling in that one contact. Your contact list is never uploaded |
| Face ID, fingerprint or passcode | Only when you reveal a saved Wi-Fi password or 2FA secret | Confirming it's you. Your biometric data never leaves the phone's secure system |
Actions like joining a Wi-Fi network, adding a calendar event or opening a map hand the information to your phone's own apps. They don't send it to us.
6. Ads and your choices
- The app shows banner ads, native ads styled like a code row, and an optional short video ad when you save a code. There are no ads while Premium is active.
- European Economic Area, UK and Switzerland: before any ad loads, Google's consent form asks for your choice. You can change it any time in Settings > Privacy > Ad preferences.
- iOS: we don't track you across other companies' apps and websites, and we request only non-personalised ads.
- Android: you can reset or delete your advertising ID in your phone's Google settings.
- Premium turns off every ad in the app. See our Terms of Use for prices.
Google's use of ad data is described at https://policies.google.com/technologies/partner-sites.
7. Legal bases (EEA, UK and Switzerland)
Where data protection laws like the GDPR apply, we rely on:
- Contract: providing the app, Premium and support you ask for.
- Legitimate interests: keeping the app secure, fixing crashes, and understanding feature use in a way that never includes the content of your codes.
- Consent: personalised ads, and any other processing where the law requires consent. You can withdraw consent at any time without affecting earlier processing.
- Legal obligation: keeping purchase records where the law requires it.
8. How long we keep information
| Information | How long |
|---|---|
| Codes, History and settings | On your phone until you delete them or uninstall the app |
| Device record | Until you ask us to delete it, or 24 months after the app last connects |
| Support and feedback messages | Up to 24 months after the conversation ends |
| Usage statistics | Up to 14 months |
| Crash reports | Up to 90 days |
| Purchase records | As long as needed to provide Premium and as required by tax and accounting laws |
| Ad data | Under Google's own retention rules |
9. Sharing
We share information only with the service providers in section 4, who process it to provide their service, and when the law requires it or to protect the rights and safety of our users or BugBittle. If BugBittle is involved in a merger or sale, information may transfer to the new owner under this policy. We don't sell personal information and we don't share it for cross-context behavioural advertising beyond the ads shown in the app as described above.
10. International transfers
Our service providers may process information outside your country, including in the United States and the European Union. Where required, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses.
11. Security
Information sent from the app is encrypted in transit (TLS). Sensitive secrets on your phone are encrypted with the phone's secure storage. Access to support messages is limited to the people who answer them. No system is perfectly secure, but we work to protect your information and will notify you and authorities where the law requires.
12. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the use of your personal information, to data portability, and to withdraw consent. California residents have the right to know, delete and correct, and to opt out of sale or sharing; we don't sell personal information.
To use these rights, email privacy@bugbittle.com. Because there is no account, we may ask for details that help us find your records, such as the email you used for support or information shown in the app. We answer within 30 days.
You can also complain to your local data protection authority.
Deleting your data yourself: clear History in Settings > Privacy, or uninstall the app to remove everything stored on your phone. To delete your device record, support messages and related data on our side, email privacy@bugbittle.com.
13. Children
QR Office is not directed to children under 13 (or under 16 in the EEA, UK and Switzerland where local law requires). We don't knowingly collect personal information from children. If you believe a child has sent us information, contact privacy@bugbittle.com and we will delete it.
14. The website
The website https://qroffice.bugbittle.com has a support form. When you send it, we receive your name (optional), email, message and the page you sent it from, stored in Google Firebase to answer you. The website shows no ads. It uses only the cookies or local storage needed to work, for example to remember light or dark mode.
15. Changes to this policy
We may update this policy as the app changes, for example when new features are added. We will change the "Last updated" date and, for important changes, tell you in the app or on the website before they apply.
16. Contact
BUGBITTLE (PRIVATE) LIMITED Johar Town, Lahore, Pakistan Privacy: privacy@bugbittle.com Support: support@bugbittle.com